PT-2023-32896 · Unknown · Code-Projects Patient Record Management System

Hamdi Sevben · Published 2023-12-28 · Updated 2024-05-17 · CVE-2023-7135

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code-projects Record Management System version 1.0

Description A problematic issue has been discovered, affecting an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input "> leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For code-projects Record Management System version 1.0, consider disabling the officename argument in the /main/offices.php file until a patch is available. Restrict access to the Offices Handler component to minimize the risk of exploitation. Avoid using the officename argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-7135

Affected Products

Code-Projects Patient Record Management System

References · 6

• 🔥 https://github.com/h4md153v63n/CVEs/blob/main/Record_Management_System/Record_Management_System-Blind_Cross_Site_Scripting-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-7135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7135 · Security Note
• https://vuldb.com/?ctiid.249138 · Note
• https://vuldb.com/?id.249138 · Note
• https://twitter.com/CVEnew/status/1740472308643299330 · Twitter Post